-
Notifications
You must be signed in to change notification settings - Fork 18
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
sumcheck protocol support mixed num_vars monomial form #235
Conversation
ce2a5b1
to
c4e3251
Compare
f4cf185
to
a076261
Compare
@kunxian-xia I plan to study what the minimal change to batching multiple table (or similar) circuit in single create_table_proof after this PR, since each table circuit only contribute one wit-in. The previous blocker for batching them is on |
ab7bb73
to
289bca3
Compare
289bca3
to
9383aaa
Compare
@@ -418,13 +449,24 @@ impl<'a, E: ExtensionField> IOPProverStateV2<'a, E> { | |||
let f = &self.poly.flattened_ml_extensions[products[0]]; | |||
op_mle! { | |||
|f| { | |||
(0..f.len()) | |||
let res = (0..largest_even_below(f.len())) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The idea behind this is for skip f.len() == 1 assuring we dont need to add extra boundary check in line 455/456 so no performance impact
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
### Goal To make sumcheck protocol support different num_vars, aiming for - [x] minimal change to sumcheck protocol, make verifier remain the same. no extra meta data passed from prover, and what prover have just mle and it's eval size Besides this PR also remove some parallism in verifier since it's unnecessary for relative low cost. ### design rationale (Also comments in codebase for reference) To deal with different num_vars, we exploit a fact that for each product which num_vars < max_num_vars, for it evaluation value we need to times 2^(max_num_vars - num_vars) E.g. Giving multivariate poly $f(X) = f_1(X1) + f_2(X), X1 \in {F}^{n'}, X \in {F}^{n}, |X1| := n', |X| = n, n' <= n$ For i round univariate poly, $f^i(x)$ $f^i[0] = \sum_b f(r, 0, b), b \in [0, 1]^{n-i-1}, r \in {F}^{n-i-1}$ chanllenge get from prev rounds = $\sum_b f_1(r, 0, b1) + f_2(r, 0, b), |b| >= |b1|, |b| - |b1| = n - n'$ = $2^{(|b| - |b1|)} * \sum_{b1} f_1(r, 0, b1) + \sum_b f_2(r, 0, b)$ same applied on f^i[1] It imply that, for every evals in f_1, to compute univariate poly, we just need to times a factor 2^(|b| - |b1|) for it evaluation value ### benchmark benchmark with ceno_zkvm `riscv_add`, and gkr `keccak` both remain the same and no impact. You might see some redundancy coding style, but this is for retain the best performance. I tried other variants and it impact benchmark results ### scope Related to #109 #210 .... To address #126 #127 This enhance protocol features potiential can be used for `range table-circuit`, `init/final-memory`, `cpu-init/cpu-final halt` to make selector sumcheck support batching different num_instance witin.
Goal
To make sumcheck protocol support different num_vars, aiming for
Besides this PR also remove some parallism in verifier since it's unnecessary for relative low cost.
design rationale
(Also comments in codebase for reference)$f(X) = f_1(X1) + f_2(X), X1 \in {F}^{n'}, X \in {F}^{n}, |X1| := n', |X| = n, n' <= n$ $f^i(x)$
$f^i[0] = \sum_b f(r, 0, b), b \in [0, 1]^{n-i-1}, r \in {F}^{n-i-1}$ chanllenge get from prev rounds$\sum_b f_1(r, 0, b1) + f_2(r, 0, b), |b| >= |b1|, |b| - |b1| = n - n'$ $2^{(|b| - |b1|)} * \sum_{b1} f_1(r, 0, b1) + \sum_b f_2(r, 0, b)$
To deal with different num_vars, we exploit a fact that for each product which num_vars < max_num_vars,
for it evaluation value we need to times 2^(max_num_vars - num_vars)
E.g. Giving multivariate poly
For i round univariate poly,
=
=
same applied on f^i[1]
It imply that, for every evals in f_1, to compute univariate poly, we just need to times a factor 2^(|b| - |b1|) for it evaluation value
benchmark
benchmark with ceno_zkvm
riscv_add
, and gkrkeccak
both remain the same and no impact.You might see some redundancy coding style, but this is for retain the best performance. I tried other variants and it impact benchmark results
scope
Related to #109 #210 ....
To address #126 #127
This enhance protocol features potiential can be used for
range table-circuit
,init/final-memory
,cpu-init/cpu-final halt
to make selector sumcheck support batching different num_instance witin.